skill-creator
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides utility scripts
scripts/init_skill.pyandscripts/package_skill.pythat perform local file system operations. These scripts use the standard Pythonpathlibandzipfilemodules to initialize skill directories, write template files, and package them into archives. These are standard automation behaviors for a development tool. - [SAFE]: The packaging logic in
scripts/package_skill.pyimplements security controls to prevent unauthorized file access. Specifically, it uses an_is_withincheck to ensure files do not escape the skill's root directory and explicitly rejects symbolic links during the archival process to mitigate path traversal risks. - [SAFE]: The validation script
scripts/quick_validate.pyperforms metadata checks on skill frontmatter using a safe YAML loader (if available) or a minimal fallback parser, ensuring the skill conforms to required naming and length constraints without executing untrusted data.
Audit Metadata